Do we need to encrypt everything stored in database, or just sensitive datas?

Question

Do we need to encrypt everything stored in database (including full name, age,...), or just sensitive infos (username, password, history activities,...)?

Answer 1

No need to encrypt all data in database. Only sensitive information like email or username and password can be encrypted.

Answer 2

Personally I would encrypt or hash sensitive data only. There is this trade between security and performance to consider, secured data needs decryption before they can be used, and be encrypted again after a modification (on saving modified data, as necessary).

The process of encryption/decryption takes relative amount of processing power, meaning lesser performance, it is inarguably important though.

Answer 3

tho.tran.#
I'm not sure about the necessity for encrypting e-mail addresses. If you don't want it visible as raw text you can hash it. But again, personally, I still think it is rather impractical for search purposes : )

Answer 4

tho.tran.#
This is an interesting topic, I'm just sharing what I found from web search, in relation to e-mail address encryption in table fields:

https://stackoverflow.com/questions/70450/is-it-worth-encrypting-email-addresses-in-the-database

https://security.stackexchange.com/questions/222103/encrypting-email-addresses-in-php

Answer 5

Ipang thanks for sharing

Answer 6

You're welcome tho.tran.# 👌

Answer 7

Thanks. In addition can you suggest some encrypt algo (in PHP,...) to secure email or other sensitive datas? Hashing isnt suitable for securing and working with these datas.

Answer 8

Ipang emails can be used later for verification and other purposes. I dont think hashing email is a good idea. Encrypting it for storing and decrypting it for using is a better idea. I think we should encrypt email before putting it into database, but not by hashing functions

Answer 9

Free Internet